Module 3 of 9

📚 M365 Admin Center Course · Module 3 of 9

Group Management

📂 Course: M365 Admin Center
📦 Module: 3 of 9
🎯 Exam: MS-102
⏱ Read time: ~22 min

⚠️

MS-102 Retiring October 31, 2026 — Replaced by AB-650

This module aligns to MS-102, which retires on October 31, 2026. The replacement exam is AB-650: Administering Microsoft 365 and AI Services (beta). Core M365 admin skills in this module carry forward into AB-650. Read our AB-650 guide →

MS-102 Exam Alignment
MS-102

Objective 1.2 — Manage users and groups (groups): create and manage group types, configure dynamic membership rules, and understand what each group type auto-provisions.

Distinguish between Microsoft 365 Groups, Security Groups, Distribution Lists, and Mail-Enabled Security Groups
Know what resources a Microsoft 365 Group auto-provisions (mailbox, SharePoint, Planner, Teams)
Configure dynamic membership rules — and know the Entra ID P1 licence requirement
Understand when to use Security Groups for access control vs M365 Groups for collaboration
Know how to restrict Microsoft 365 Group/Team creation to specific users

Exam Tip: Group types are heavily tested. The key distinction: Microsoft 365 Groups = collaboration (Teams, SharePoint, shared mailbox); Security Groups = access control only (no email, no SharePoint site). Dynamic membership requires Entra ID P1 — this prerequisite is regularly tested.

Groups in Microsoft 365 are far more than mailing lists. Different group types serve completely different purposes — Microsoft 365 Groups back Teams channels and SharePoint sites, Security Groups control resource access, Distribution Lists handle bulk email, and Dynamic Groups automatically manage membership based on user attributes. Understanding which type to use and when is one of the most consistently tested M365 administrator topics.

👥 Types of Groups in Microsoft 365

Group Type	Used For	Has Email	Dynamic Members
Microsoft 365 Group	Teams workspaces, SharePoint sites, shared mailbox, Planner, OneNote	✅ Yes	✅ Requires Entra P1
Security Group	Controlling access to apps, SharePoint, Conditional Access policies, Intune	❌ No	✅ Requires Entra P1
Distribution List	Sending bulk email to a list of recipients — no collaboration features	✅ Yes	❌ No
Mail-Enabled Security	Access control AND email — combines Security Group + Distribution List	✅ Yes	❌ No

💡 The Key Distinction — Most Tested Interview Topic

When a user creates a Team in Microsoft Teams, a Microsoft 365 Group is automatically provisioned behind it — this group backs the SharePoint team site, shared Exchange mailbox, Planner board, and OneNote. Security Groups do NOT have these collaboration features — they are purely for access control. This distinction is tested in almost every M365 admin interview.

🔷 Microsoft 365 Groups (Unified Groups)

Microsoft 365 Groups are the modern collaboration group type. Creating one automatically provisions the following resources:

Shared Exchange mailbox — group members can send to and receive from the group email address
SharePoint team site — a shared document library and pages site for the group
Planner board — shared task management for the group
OneNote notebook — shared notes accessible to all members
Teams workspace — if a Team is created from or linked to the group

⚠️ Group Creation Policy — Default Is Open

By default, any licensed user can create a Microsoft 365 Group (and therefore a Team), leading to uncontrolled sprawl. To restrict creation to specific users, configure the M365 Group creation policy in Entra ID — you specify a security group whose members are the only ones allowed to create new groups. This requires Entra ID P1 licensing.

🔐 Security Groups

Security Groups are the standard way to control access to resources in Microsoft 365 and Azure:

Granting SharePoint site access to a department without managing individuals
Targeting Conditional Access policies at specific user populations
Controlling who can create Microsoft 365 Groups or Teams
Assigning application permissions in Entra ID (app registrations)
Targeting Intune device compliance and configuration policies

📋 Creating Groups — Portal Walkthrough

M365 Admin Center › Teams & Groups › Active groups › + Add a group

Microsoft 365 admin center
|
Teams & Groups › Active groups

Teams & Groups

👥 Active groups

🗑 Deleted groups

📋 Shared mailboxes

Active groups

+ Add a group ①

All (84)

Microsoft 365 (41)

Security (28)

Distribution (15)

Name	Type	Email
Marketing Team	Microsoft 365	marketing@contoso.com
IT-Admins	Security	—
All Staff Newsletter	Distribution	allstaff@contoso.com

① Click + Add a group — you are asked to choose the group type first. The type you select determines which features are available after creation. For Teams collaboration, choose Microsoft 365. For access control only, choose Security. For bulk email to a list, choose Distribution.

Creating a Group — Step by Step

1

Go to Teams & Groups → Active groups → + Add a group
2

Select the group type (Microsoft 365, Security, Distribution, or Mail-Enabled Security)
3

Enter the group name, description, and email alias (for mail-enabled types)
4

Set the group owner(s) — owners can add/remove members and manage group settings
5

Add initial members. For Microsoft 365 Groups, also set the privacy level (Private = members only / Public = anyone in org can join)
6

Review and create. For Microsoft 365 Groups, the SharePoint site and mailbox are provisioned within a few minutes

⚙️ Dynamic Membership Rules

💡 What Is Dynamic Membership?

Dynamic membership automatically adds and removes users from a group based on user attribute values in Entra ID — department, job title, company, location, employeeType, and others. This requires Microsoft Entra ID P1 or P2 licensing. With dynamic groups you never manually manage membership — users join when they match the rule and leave when they no longer match.

Example dynamic membership rule:

  (user.department -eq "Sales") -and (user.accountEnabled -eq true)

This rule automatically includes all enabled users whose department attribute is set to "Sales". Any user whose department changes away from Sales is automatically removed from the group.

✅ Practical Use Case — Group-Based Licensing

Combine dynamic groups with group-based licensing for fully automated provisioning. Create a dynamic Security Group with rule (user.department -eq "Sales"), then assign your Sales license package to that group in Entra ID. New Sales employees automatically receive the correct licenses within minutes of their user record being updated — no manual admin action required.

⚡ PowerShell — Group Management

PowerShell — Microsoft Graph — Group Management

Connect-MgGraph -Scopes "Group.ReadWrite.All"

# List all groups with type information
Get-MgGroup -All | Select DisplayName, GroupTypes, MailEnabled, SecurityEnabled

# Create a Microsoft 365 Group (GroupTypes = Unified)
New-MgGroup -DisplayName "Finance Team" -MailNickname "FinanceTeam" -GroupTypes @("Unified") -MailEnabled $true -SecurityEnabled $false

# Create a Security Group
New-MgGroup -DisplayName "IT-VPN-Users" -MailNickname "IT-VPN-Users" -MailEnabled $false -SecurityEnabled $true

# Add a member to a group
New-MgGroupMember -GroupId "[group-object-id]" -DirectoryObjectId "[user-object-id]"

# Get all members of a group
Get-MgGroupMember -GroupId "[group-object-id]"

🎓 Interview Q&A

Q: What is the difference between a Microsoft 365 Group and a Security Group?

A Microsoft 365 Group (Unified Group) is a collaboration group that automatically provisions a shared Exchange mailbox, SharePoint team site, Planner board, OneNote, and optionally a Teams workspace. It is designed for team collaboration. A Security Group is for access control only — granting permissions to resources, targeting Conditional Access policies, or controlling feature access. Security Groups have no email or collaboration features by default. The interview answer is: Microsoft 365 Groups = collaboration; Security Groups = access control.

Q: What is dynamic group membership and what license is required?

Dynamic membership automatically adds or removes users from a group based on a rule evaluated against user attribute values in Entra ID (e.g. department, job title, location). When a user's attributes match the rule they are added; when they no longer match they are removed. No manual membership management is needed. This requires Microsoft Entra ID P1 (or P2) licensing for the users being managed. It is supported on both Microsoft 365 Groups and Security Groups.

Q: When would you use a Distribution List instead of a Microsoft 365 Group?

Use a Distribution List when you only need one-way email to a group of recipients and have no need for collaboration features. DLs have lower overhead and no SharePoint/Teams/Planner provisioning. Common examples are company-wide announcement lists or department notification feeds. If the group also needs to collaborate — share files, run meetings, manage tasks — use a Microsoft 365 Group instead.

Q: How do you prevent users from creating their own Microsoft Teams or Microsoft 365 Groups?

By default all licensed users can create Microsoft 365 Groups (and therefore Teams). To restrict this, go to the Entra ID portal under Groups settings and configure the group creation restriction — you specify a security group whose members are the only ones permitted to create new M365 Groups. Users outside this group receive an error when they try to create a Team or Group. Requires Entra ID P1 licensing.

🎯 MS-102 Mock Test

Module 3 — Group Management

5 questions · Scenario-based · MS-102 exam style · Pass mark: 70%

Question 1 of 5

A project team needs a shared space where they can collaborate on documents, track tasks in Planner, and communicate via a shared email address. Which group type should you create?

ASecurity Group

BDistribution List

CMicrosoft 365 Group

DMail-Enabled Security Group

✅ Correct answer: C. A Microsoft 365 Group automatically provisions a shared Exchange mailbox, SharePoint team site, Planner board, and OneNote notebook. It is the only group type that bundles all these collaboration resources together.

Question 2 of 5

You want to automatically manage membership of a security group so that all users in the Engineering department are included, and members are removed when they leave the department. What is required?

AA PowerShell script scheduled to run nightly

BDynamic membership rule on the Security Group and Microsoft Entra ID P1 licensing

CConvert the Security Group to a Microsoft 365 Group with dynamic membership

DDynamic membership is automatic — no licence requirement

✅ Correct answer: B. Dynamic membership rules are supported on both Security Groups and Microsoft 365 Groups. This requires Microsoft Entra ID P1 (or P2) licensing for the users being dynamically managed. Without P1, the dynamic membership option is not available in the group settings.

Question 3 of 5

Your organisation needs to control access to a SharePoint site so that only members of the HR department can access it. No collaboration features or email are required. Which group type is most appropriate?

AMicrosoft 365 Group — it supports SharePoint site permissions

BDistribution List — it can be used for both email and access control

CSecurity Group — designed for access control with no unnecessary email overhead

DMail-Enabled Security Group — it provides email and access control

✅ Correct answer: C. Security Groups are purpose-built for access control. Since no email or collaboration features are required, a Security Group is the most appropriate choice. Using a Microsoft 365 Group would unnecessarily provision a mailbox, SharePoint site, Planner, and OneNote.

Question 4 of 5

When a Microsoft Teams team is created by a user, what is automatically provisioned alongside it?

AA Microsoft 365 Group with a shared mailbox, SharePoint team site, Planner board, and OneNote

BA Security Group with access to the Teams channel

CA Distribution List for sending announcements to the team

DA Mail-Enabled Security Group with a Teams channel

✅ Correct answer: A. Every Microsoft Teams team is backed by a Microsoft 365 Group. When the team is created, M365 automatically provisions: a Microsoft 365 Group, a shared Exchange mailbox, a SharePoint Online team site, a Planner board, and a OneNote notebook.

Question 5 of 5

Users in your organisation are creating Microsoft 365 Groups freely, leading to hundreds of abandoned Teams and SharePoint sites. How do you restrict Group creation to only IT administrators?

ARemove the Group.Create permission from all users in Entra ID app permissions

BConfigure the M365 Group creation policy in Entra ID to only allow members of a specific security group — requires Entra P1

CAssign the Teams Administrator role only to IT administrators — this blocks others from creating Teams

DDelete unused groups monthly — there is no way to restrict creation

✅ Correct answer: B. The Group creation policy in Entra ID (Groups → Settings → General) lets you restrict M365 Group creation to members of a specified security group. Anyone not in that group receives an error when trying to create a Team or Group. This requires Entra ID P1 licensing.